cribra 0.2.0

Privacy-first Rust core for detecting, querying, and safely transforming secrets and sensitive data
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

//! Built-in rules for credentials recognizable from their value alone.

use crate::{Remediation, RuleSpec, Severity, validators::dispatch::ValidatorKind};

/// GitHub classic personal access token.
pub const GITHUB_CLASSIC_PAT: RuleSpec =
    RuleSpec::prefix("github.classic-pat", "ghp_", Severity::Critical)
        .with_validator(ValidatorKind::GitHub)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// GitHub fine-grained personal access token.
pub const GITHUB_FINE_GRAINED_PAT: RuleSpec =
    RuleSpec::prefix("github.fine-grained-pat", "github_pat_", Severity::Critical)
        .with_validator(ValidatorKind::GitHub)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// GitHub OAuth access token.
pub const GITHUB_OAUTH_TOKEN: RuleSpec =
    RuleSpec::prefix("github.oauth-token", "gho_", Severity::Critical)
        .with_validator(ValidatorKind::GitHub)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// GitHub App user access token.
pub const GITHUB_APP_USER_TOKEN: RuleSpec =
    RuleSpec::prefix("github.app-user-token", "ghu_", Severity::Critical)
        .with_validator(ValidatorKind::GitHub)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Opaque GitHub App installation token.
pub const GITHUB_APP_INSTALLATION_TOKEN: RuleSpec =
    RuleSpec::prefix("github.app-installation-token", "ghs_", Severity::Critical)
        .with_validator(ValidatorKind::GitHub)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Stateless GitHub App installation token.
pub const GITHUB_STATELESS_INSTALLATION_TOKEN: RuleSpec = RuleSpec::pattern(
    "github.stateless-installation-token",
    r"\bghs_[0-9]+_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b",
    Severity::Critical,
)
.with_validator(ValidatorKind::GitHub)
.with_remediation(Remediation::RevokeAndRotateCredential);

/// GitHub App refresh token.
pub const GITHUB_APP_REFRESH_TOKEN: RuleSpec =
    RuleSpec::prefix("github.app-refresh-token", "ghr_", Severity::Critical)
        .with_validator(ValidatorKind::GitHub)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Stripe live-mode secret API key.
pub const STRIPE_LIVE_SECRET_KEY: RuleSpec =
    RuleSpec::prefix("stripe.live-secret-key", "sk_live_", Severity::Critical)
        .with_validator(ValidatorKind::Stripe)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Stripe test-mode secret API key.
pub const STRIPE_TEST_SECRET_KEY: RuleSpec =
    RuleSpec::prefix("stripe.test-secret-key", "sk_test_", Severity::High)
        .with_validator(ValidatorKind::Stripe)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Stripe live-mode restricted API key.
pub const STRIPE_LIVE_RESTRICTED_KEY: RuleSpec =
    RuleSpec::prefix("stripe.live-restricted-key", "rk_live_", Severity::Critical)
        .with_validator(ValidatorKind::Stripe)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Stripe test-mode restricted API key.
pub const STRIPE_TEST_RESTRICTED_KEY: RuleSpec =
    RuleSpec::prefix("stripe.test-restricted-key", "rk_test_", Severity::High)
        .with_validator(ValidatorKind::Stripe)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Stripe webhook endpoint signing secret.
pub const STRIPE_WEBHOOK_SIGNING_SECRET: RuleSpec =
    RuleSpec::prefix("stripe.webhook-secret", "whsec_", Severity::Critical)
        .with_validator(ValidatorKind::Stripe)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Cloudflare global API key.
pub const CLOUDFLARE_GLOBAL_API_KEY: RuleSpec =
    RuleSpec::prefix("cloudflare.global-api-key", "cfk_", Severity::Critical)
        .with_validator(ValidatorKind::Cloudflare)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Cloudflare user-scoped API token.
pub const CLOUDFLARE_USER_API_TOKEN: RuleSpec =
    RuleSpec::prefix("cloudflare.user-api-token", "cfut_", Severity::Critical)
        .with_validator(ValidatorKind::Cloudflare)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Cloudflare account-owned API token.
pub const CLOUDFLARE_ACCOUNT_API_TOKEN: RuleSpec =
    RuleSpec::prefix("cloudflare.account-api-token", "cfat_", Severity::Critical)
        .with_validator(ValidatorKind::Cloudflare)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Slack bot token.
pub const SLACK_BOT_TOKEN: RuleSpec =
    RuleSpec::prefix("slack.bot-token", "xoxb-", Severity::Critical)
        .with_validator(ValidatorKind::Slack)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Slack user token.
pub const SLACK_USER_TOKEN: RuleSpec =
    RuleSpec::prefix("slack.user-token", "xoxp-", Severity::Critical)
        .with_validator(ValidatorKind::Slack)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Slack app-level token.
pub const SLACK_APP_LEVEL_TOKEN: RuleSpec =
    RuleSpec::prefix("slack.app-level-token", "xapp-", Severity::Critical)
        .with_validator(ValidatorKind::Slack)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Slack workflow token.
pub const SLACK_WORKFLOW_TOKEN: RuleSpec =
    RuleSpec::prefix("slack.workflow-token", "xwfp-", Severity::Critical)
        .with_validator(ValidatorKind::Slack)
        .with_remediation(Remediation::RevokeAndRotateCredential);

/// Telegram Bot API token.
pub const TELEGRAM_BOT_TOKEN: RuleSpec = RuleSpec::pattern(
    "telegram.bot-token",
    r"\b[0-9]{5,20}:[A-Za-z0-9_-]{20,128}\b",
    Severity::Critical,
)
.with_validator(ValidatorKind::Telegram)
.with_remediation(Remediation::RevokeAndRotateCredential);

/// Signed JWT/JWS compact serialization.
pub const SIGNED_JWT: RuleSpec = RuleSpec::pattern(
    "jwt.signed-compact",
    r"\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b",
    Severity::High,
)
.with_validator(ValidatorKind::Jwt)
.with_remediation(Remediation::RemoveSensitiveValue);